Most multinationals have e-invoicing on their radar: However, the conversation is often led by price and platform integration costs, rather than by compliance risk. Selecting an e-invoicing service provider sounds like an IT procurement decision. Itâs not.
The real decision (the one that matters when things go wrong) isnât which provider to appoint. Itâs whether the business has built a compliance architecture that can withstand operational failure and regulatory scrutiny.
The accredited service provider, or ASP, is a critical part of that architecture. The contract is where the risk sits.
Businesses in the United Arab Emirates with annual revenue of at least 50 million UAE dirham ($13.6 million) must appoint an ASP by July 31, 2026, and go live no later than Jan. 1, 2027, under Ministerial Decision No. 244 of 2025.
Ministerial Decision No. 243 of 2025 makes clear that the system applies to any person conducting business in the UAE and to every business transaction, except where specifically excluded. The model is built around a five-corner framework involving the supplier, the supplierâs ASP, the buyerâs ASP, the buyer, and the Federal Tax Authority.
For first-wave taxpayers, the immediate task isnât merely to select a provider. Itâs to run a coordinated diligence and contracting exercise across tax, finance, technology, legal, and information security teams.
Businesses in the UAE that are establishing an ASP should keep the following guidance in mind:
Start at the right point. For many multinationals, the instinct will be familiarity: âWe already use this vendor in Saudi Arabia.â That reduces procurement friction and satisfies governance committees. But familiarity in one market isnât capability in another.
The UAE framework isnât a replication of the Saudi model. It has distinct accreditation requirements, data localization expectations, and tax authority reporting obligations. The UAE National Cloud Security Policy governs how ASPs handle cloud solutions. In banking, healthcare, and financial services, sector regulators impose additional data localization requirements on top of the general e-invoicing framework.
An international ASP whose infrastructure sits outside the UAE may not satisfy those requirements. Invoice data traveling through foreign infrastructure may carry commercial sensitivity and cross-border disclosure risks.
The better question isnât whether a business knows the vendor from another marketâitâs whether that vendor can support a defensible compliance architecture in the UAE.
The taxpayer canât outsource liability. Ministerial Decisions No. 243 and 244 of 2025 define issuer and recipient obligations. Cabinet Decision No. 106 of 2025 provides the penalty regime. None of those consequences transfer to the ASP, whether by contract or by law.
If an ASP fails to report transactions due to a validation error, transmission delay, or system outage, the compliance consequences rest entirely with the business. Civil recovery against an ASP is possible, but only if the contract addresses that scenario with enough specificity. This is what makes the contract the real decision.
Consider substance behind the accreditation. The Ministryâs public page currently lists 20 pre-approved e-invoicing service providers, but accreditation alone doesnât tell a business what it needs to know.
The Ministryâs own guidance makes the point: A providerâs local presence and UAE operating experience directly affects its ability to meet Emirate-level and sector-specific requirements.
The taxpayer still carries the real risk. Appointing an ASP doesnât transfer the taxpayerâs compliance burden. The business remains responsible for selecting the ASP, finalizing contractual obligations, agreeing how invoice data is transmitted, testing end-to-end exchange and reporting, and agreeing roles and responsibilities for error resolution.
If something breaks (validation failures, incomplete reporting logs, support breakdowns during a billing peak), the taxpayer must still demonstrate the robustness of its compliance environment. Contractual recourse against the ASP isnât the same thing as regulatory compliance.
Contracting is where the real decision gets made. ASP selection and contracting should be treated as separate but connected workstreams. A familiar provider on weak contractual terms may leave a business more exposed than a lesser-known provider on a stronger agreement. Five areas are non-negotiable:
- Regulatory scope specifics: The contract should map ASP responsibilities to the UAE framework. Each obligation should be expressly assigned, with regulatory references alongside commercial descriptions.
- Service-level agreement consequences tied to actual penalty exposure: Where an ASP validation failure or transmission delay causes a missed tax authority reporting window, the contractual remedy must be quantified and recoverable, not absorbed into a service credit capped at a fraction of the monthly fee. A missed reporting window can trigger tax authority penalties and create an audit trail gap. A 5% monthly fee credit isnât meaningful recourse. The contract must define what constitutes an ASP-caused failure, how liability is calculated, and what the cap covers.
- Data architecture warranty and access rights: The contract should include a written representation from the ASP confirming the jurisdictions in which invoice data is stored, processed, and backed up; the cloud infrastructure provider and its parent entityâs legal jurisdiction; and a prohibition on processing outside agreed jurisdictions without prior written consent. Businesses must also have timely access to transmission logs, tax authority reporting confirmations, and audit trails.
- Unqualified audit cooperation obligations: The contract should require the ASP to produce all invoice records, transmission logs, tax authority reporting confirmations, and system event logs within a defined window of receiving an audit notice, and to cooperate with tax inspectors if required.
- Exit and transition provisions: Businesses shouldnât treat provider status as static. Agreements should address loss of accreditation, service suspension, transition support, handover obligations, and machine-readable export of all relevant records. A termination right triggered by loss of accreditation, with a minimum notice period and structured transition assistance, should be standard.
Businesses can act now. Businesses should ask: Where do support teams sit? How are incidents escalated? Does the provider own the product? Where does the data reside? How are logs preserved? How will onboarding and testing work through the EmaraTax platform?
The broader question is which provider gives the business a defensible compliance architecture for the UAE. On that issue, operating model, contractual discipline, support capability, and data design may matter just as much as the technology itself.
This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law, Bloomberg Tax, and Bloomberg Government, or its owners.
Nimish Goel is leader, Middle East at Dhruva, Ryan LLC Affiliate, where he advises multinational companies on indirect tax, corporate tax, and digital compliance strategies across the Gulf region.
Geet Shah is a partner at Dhruva, Ryan LLC Affiliate, and specializes in VAT and indirect tax across the GCC, advising on implementation, compliance, disputes, and trade policy matters.
To contact the editors responsible for this story:
Learn more about Bloomberg Tax or Log In to keep reading:
From research to software to news, find what you need to stay ahead.
Log in to keep reading or access research tools and resources.
Comments
No comments yet. Be the first to comment!